Incorrect Regular Expression in Symfony - CVE-2026-45065
Published: May 21, 2026
Vulnerability identifier: #VU132066
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45065
CWE-ID: CWE-185
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect users to an untrusted site.
The vulnerability exists due to incorrect regular expression handling in UrlGenerator when validating route parameter values against regex alternation requirements during URL generation. A remote attacker can supply a crafted parameter value that passes validation and produces a protocol-relative URL to redirect users to an untrusted site.
The issue occurs because anchoring applies only to the first and last alternatives in an ungrouped alternation pattern.
Affected software
Symfony
Debian Linux
symfony (Debian package)
Debian Linux
symfony (Debian package)
How to mitigate CVE-2026-45065
Install security update from vendor's website.
Symfony - addressed in versions 5.4.52, 6.4.40, 7.4.12, 8.0.12
symfony (Debian package) - addressed in versions 5.4.53+dfsg-0+deb12u1, 6.4.41+dfsg-0+deb13u1
symfony (Debian package) - addressed in versions 5.4.53+dfsg-0+deb12u1, 6.4.41+dfsg-0+deb13u1